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1. Introduction 


Master-Slave/Token-Passing (MS/TP) is a Medium Access Control (MAC) 
protocol for the RS-485 [TIA-485-A] physical layer and is used 
primarily in building automation networks. This specification 
defines the frame format for transmission of IPv6 [RFC2460] packets 
and the method of forming link-local and statelessly autoconfigured 


IPv6 addresses on MS/TP networks. The general approach is to adapt 
elements of the 6LoWPAN specifications ([RFC4944], [RFC6282], and 
[RFC6775]) to constrained wired networks, as noted below. 


An MS/TP device is typically based on a low-cost microcontroller with 
limited processing power and memory. These constraints, together 
with low data rates and a small MAC address space, are similar to 
those faced in 6LoWPAN networks.  MS/TP differs significantly from 
6LoWPAN in at least three respects: a) MS/TP devices are typically 
mains powered, b) all MS/TP devices on a segment can communicate 
directly so there are no hidden node or mesh routing issues, and c) 
the latest MS/TP specification provides support for large payloads, 
eliminating the need for fragmentation and reassembly below IPv6. 


The following sections provide a brief overview of MS/TP and then 
describe how to form IPv6 addresses and encapsulate IPv6 packets in 
MS/TP frames. This specification (subsequently referred to as 
"6LOBAC") includes a REQUIRED header compression mechanism that is 
based on LOWPAN IPHC [RFC6282] and improves MS/TP link utilization. 


1.1. Requirements Language 
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 
document are to be interpreted as described in [RFC2119]. 


1.2. Abbreviations Used 


ASHRAE: American Society of Heating, Refrigerating, and Air- 
Conditioning Engineers «http://www.ashrae.org» 


BACnet: An ISO/ANSI/ASHRAE Standard Data Communication Protocol for 
Building Automation and Control Networks 


CRC: Cyclic Redundancy Code 
MAC: Medium Access Control 
MSDU: MAC Service Data Unit (MAC client data) 
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Ts 


3. 


MTU: Maximum Transmission Unit; the size of the largest data unit 
at the network-layer protocol that can be communicated in a 
single network transaction 


UART: Universal Asynchronous Transmitter/Receiver 
MS/TP Overview 


This section provides a brief overview of MS/TP, as specified in 
Clause 9 of the ANSI/ASHRAE Standard 135-2016 [BACnet]. The latest 
version of [BACnet] integrates changes to legacy MS/TP (approved as 
[Addendum_an]) that provide support for larger frame sizes and 
improved error handling. [BACnet], Clause 9 also covers physical- 
layer deployment options. 


MS/TP is designed to enable multidrop networks over shielded twisted 
pair wiring. It can support network segments up to 1000 meters in 
length at a data rate of 115.2 kbit/s or segments up to 1200 meters 
in length at lower bit rates. An MS/TP interface requires only a 
UART, an RS-485 [TIA-485-A] transceiver with a driver that can be 
disabled, and a 5 ms resolution timer. The MS/TP MAC is typically 
implemented in software. 


The differential signaling used by [TIA-485-A] requires a contention- 
free MAC. MS/TP uses a token to control access to a multidrop bus. 
Only an MS/TP master node can initiate the unsolicited transfer of 
data, and only when it holds the token. After sending at most a 
configured maximum number of data frames, a master node passes the 
token to the next master node (as determined by the MAC address). If 
present on the link, legacy MS/TP implementations (including any 
Slave nodes) ignore the frame format defined in this specification. 


[BACnet], Clause 9 defines a range of Frame Type values used to 
designate frames that contain Data and Data CRC fields encoded using 
Consistent Overhead Byte Stuffing [COBS] (see Appendix B). The 
purpose of COBS encoding is to eliminate preamble sequences from the 
Encoded Data and Encoded CRC-32K fields. The Encoded Data field is 
covered by a 32-bit CRC [CRC32K] (see Appendix C) that is also COBS 
encoded. 
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MS/TP COBS-encoded frames have the following format: 


0 
0123456789 
t—+—+-4+-+-4+-4+-4+-4-4+- 
| 0x55 | 
t—+—+-4+-4+-4+-4+-4-4-4- 
| SA | 

+ + 


-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 


OH 
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Lengt 


+-+-+-+-+-+-+-+-+-+-+- 
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+ 
Frame Type | 
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h (MS octet first) | 
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Encoded Data (2 - 1506 octets) 


pc 
+ 
l 
+ 
l 
+ 
l 
+ 
l 
+ 
l 


+-+-+-+-+-+-+-+-+-+-+ 
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-+-+-+-+-+-+-+-+ 


Header CRC | 


+-+-+-+-+-+-+-+ 


+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 


| Encoded CRC-32K 


( 


5 octets) | 


+-+-+-+-+-+-+-+-+ 


| optional OxFF | 
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +++ 


Figure 1: MS/TP COBS-Encoded Frame Format 


MS/TP COBS-encoded frame fields are defined as follows: 


Preamble 

Frame Type 
Destination Address 
Source Address 
Length 

Header CRC 

Encoded Data 
Encoded CRC-32K 
(pad) 


two 
one 
one 
one 
two 
one 
2 = 


octet preamble: 0x55, OxFF 


octet 

octet address 

octet address 

octets, most significant 
octet 

1506 octets (see Section 


five octets (see Appendix C) 


(op 


tional) at most one octet 


octet first 
4 and Appendix B) 


of trailer: OxFF 


The Frame Type is used to distinguish between different types of MAC 


frames. The types relevant to this specification 
0 Token 
1 Poll For Master 
2 Reply To Poll For Master 
3 Test Request 
4 Test Response 


34 IPv6 over MS/TP (LOBAC) Encapsulation 


(in decimal) are: 


Frame Types 8 - 31 and 35 - 127 are reserved for assignment by 
ASHRAE. Frame Types 32 - 127 designate COBS-encoded frames that 


convey Encoded Data and Encoded CRC-32K fields. 


additional details. 
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The Destination and Source Addresses are each one octet in length. 
See Section 3 for additional details. 


For COBS-encoded frames, the Length field indicates the size of the 
[COBS] Encoded Data field in octets, plus three. (This adjustment is 
required in order for legacy MS/TP devices to ignore COBS-encoded 
frames.) See Section 4 and the Appendices for additional details. 


The Header CRC field covers the Frame Type, Destination Address, 
Source Address, and Length fields. The Header CRC generation and 
check procedures are specified in [BACnet], Annex G.1. 


Use of the optional OxFF trailer octet is discussed in [BACnet], 
Clause 9. 


1.4. Goals and Constraints 


The main goals of this specification are a) to enable IPv6 directly 
on wired end devices in building automation and control networks by 
leveraging existing standards to the greatest extent possible, and b) 
to co-exist with legacy MS/TP implementations.  Co-existence allows 
MS/TP networks to be incrementally upgraded to support IPv6. 


In order to co-exist with legacy devices, no changes are permitted to 
the MS/TP addressing modes, frame header format, control frames, or 
Master Node state machine as specified in [BACnet], Clause 9. 


2. Profile for IPv6 over MS/TP 


ASHRAE has assigned an MS/TP Frame Type value of 34 to indicate IPv6 
over MS/TP (LoBAC) Encapsulation. This falls within the range of 
values that designate COBS-encoded data frames. 


2.1. Mandatory Features 


[BACnet], Clause 9 specifies mandatory-to-implement features of MS/TP 
devices. For example, it is mandatory that all MS/TP nodes respond 
to a Test Request with a Test Response frame. All MS/TP master nodes 
must implement the Master Node state machine and handle Token, Poll 
For Master, and Reply To Poll For Master control frames.  6LoBAC 
nodes are MS/TP master nodes that implement a Receive Frame state 
machine capable of handling COBS-encoded frames. 


6LoBAC nodes must support a data rate of 115.2 kbit/s and may support 


lower data rates as specified in [BACnet], Clause 9. The method of 
selecting the data rate is outside the scope of this specification. 
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2.2. Configuration Constants 
The following constants are used by the Receive Frame state machine. 


Nmin COBS length The minimum valid Length value of any LoBAC- 
encapsulated frame: 5 


Nmax COBS length The maximum valid Length value of any LoBAC- 
encapsulated frame: 1509 


2.3. Configuration Parameters 


The following parameters are used by the Master Node state machine. 


Nmax info frames The default maximum number of information frames 
the node may send before it must pass the token: 1 


Nmax master The default highest allowable address for master 
nodes: 127 


The mechanisms for setting parameters or monitoring MS/TP performance 
are outside the scope of this specification. 


3. Addressing Modes 


MS/TP node (MAC) addresses are one octet in length and are assigned 
dynamically. The method of assigning MAC addresses is outside the 
Scope of this specification. However, each MS/TP node on the link 
MUST have a unique address in order to ensure correct MAC operation. 


[BACnet], Clause 9 specifies that addresses 0 through 127 are valid 
for master nodes. The method specified in Section 6 for creating a 
MAC-address-derived Interface Identifier (IID) ensures that an IID of 
all zeros can never be generated. 


A Destination Address of 255 (all nodes) indicates a MAC-layer 
broadcast.  MS/TP does not support multicast; therefore, all IPv6 
multicast packets MUST be broadcast at the MAC layer and filtered at 
the IPv6 layer. A Source Address of 255 MUST NOT be used. 


Hosts learn IPv6 prefixes via router advertisements according to 
[RFC4861]. 
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4. Maximum Transmission Unit (MTU) 


Upon transmission, the network-layer MTU is formatted according to 
Section 5 and becomes the MAC service data unit (MSDU). The MSDU is 
then COBS encoded by MS/TP. Upon reception, the steps are reversed. 
[BACnet], Clause 9 supports MSDUs up to 2032 octets in length. 


IPv6 [RFC2460] requires that every link in an internet have an MTU of 
1280 octets or greater. Additionally, a node must be able to accept 
a fragmented packet that, after reassembly, is as large as 1500 
octets. This specification defines an MTU length of at least 1280 
octets and at most 1500 octets. Support for an MTU length of 1500 
octets is RECOMMENDED. 


5.  LoBAC Adaptation Layer 


This section specifies an adaptation layer to support compressed IPv6 
headers as specified in Section 10.  IPv6 header compression MUST be 
implemented on all 6LoBAC nodes.  Implementations MAY also support 
Generic Header Compression [RFC7400] for transport layer headers. 


The LoBAC encapsulation format defined in this section describes the 
MSDU of an IPv6 over MS/TP frame. The LoBAC payload (i.e., an IPv6 
packet) follows an encapsulation header stack.  LoBAC is a subset of 
the LoWPAN encapsulation defined in [RFC4944], as updated by 
[RFC6282], so the use of "LOWPAN" in literals below is intentional. 
The primary difference between LoWPAN and LoBAC encapsulation is 
omission of the Mesh, Broadcast, Fragmentation, and LOWPAN HC1 
headers in the latter. 


All LoBAC-encapsulated datagrams transmitted over MS/TP are prefixed 
by an encapsulation header stack consisting of a Dispatch value 
followed by zero or more header fields. The only sequence currently 
defined for LoBAC is the LOWPAN IPHC header followed by payload, as 
shown below: 


Figure 2: A LoBAC-Encapsulated LOWPAN IPHC Compressed IPv6 Datagram 


The Dispatch value is treated as an unstructured namespace. Only a 
single pattern is used to represent current LoBAC functionality. 
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Pattern Header Type 


Figure 3: LoBAC Dispatch Value Bit Pattern 


Other IANA-assigned 6LoWPAN Dispatch values do not apply to 6LoBAC 
unless otherwise specified. 


6. Stateless Address Autoconfiguration 


This section defines how to obtain an IPv6 Interface Identifier. 
This specification distinguishes between two types of IIDs, MAC- 
address-derived and semantically opaque. 


A MAC-address-derived IID is the RECOMMENDED type for use in forming 
a link-local address, as it affords the most efficient header 
compression provided by the LOWPAN IPHC [RFC6282] format specified in 
Section 10. The general procedure for creating a MAC-address-derived 
IID is described in Appendix A of [RFC4291], "Creating Modified 
EUI-64 Format Interface Identifiers", as updated by [RFC7136]. 


The Interface Identifier for link-local addresses SHOULD be formed by 
concatenating the node's 8-bit MS/TP MAC address to the seven octets 
0x00, 0x00, 0x00, OxFF, OxFE, 0x00, and 0x00. For example, an MS/TP 
MAC address of hexadecimal value Ox4F results in the following IID: 


|o 1/1 313 4|4 6 | 
|o 5|6 ds 718 3| 
4---------------- 4---------------- 4-—--------------- 4---------------- t 
[0000000000000000|0000000011111111|1111111000000000]|0000000001001111| 
4---------------- 4---------------- 4---------------- 4---------------- t 


A semantically opaque IID having 64 bits of entropy is RECOMMENDED 
for each globally scoped address and MAY be locally generated 
according to one of the methods cited in Section 12. A node that 
generates a 64-bit semantically opaque IID MUST register the IID with 
its local router(s) by sending a Neighbor Solicitation (NS) message 
with the Address Registration Option (ARO) and process Neighbor 
Advertisements (NAs) according to [RFC6775]. 


An IPv6 address prefix used for stateless autoconfiguration [RFC4862] 
of an MS/TP interface MUST have a length of 64 bits. 
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da IPv6 Link-Local Address 


The IPv6 link-local address [RFC4291] for an MS/TP interface is 
formed by appending the Interface Identifier, as defined above, to 
the prefix FE80::/64. 


[1111111010 | (zeros) Interface Identifier 
4F---------- 4----------------------- 4---------------------------- + 


8. Unicast Address Mapping 


The address resolution procedure for mapping IPv6 non-multicast 
addresses into MS/TP MAC-layer addresses follows the general 
description in Section 7.2 of [RFC4861], unless otherwise specified. 


The Source/Target Link-Layer Address option has the following form 
when the addresses are 8-bit MS/TP MAC-layer (node) addresses. 


0 1 

O 12345678 9012345 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
| Type | Length=1 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 
| 0x00 | MS/TP Address 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- 


Padding (all zeros) 


+— + — +— +— + 


| 

ie nee EE 

Option fields: 

Type: 

1: for Source Link-Layer address. 
2: for Target Link-Layer address. 

Length: This is the length of this option (including the Type and 
Length fields) in units of 8 octets. The value of this field 
is 1 for 8-bit MS/TP MAC addresses. 

MS/TP Address: The 8-bit address in canonical bit order [RFC2469]. 


This is the unicast address the interface currently responds 
to. 
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9 


10. 


dd 


Multicast Address Mapping 


All IPv6 multicast packets MUST be sent to MS/TP Destination Address 
255 (broadcast) and filtered at the IPv6 layer. When represented as 
a 16-bit address in a compressed header (see Section 10), it MUST be 
formed by padding on the left with a zero octet: 


0 1 
0123456789012345 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
| 0x00 | OxFF | 
EE 


Header Compression 


6LOBAC REQUIRES LOWPAN_IPHC IPv6 compression, which is specified in 
[RFC6282] and included herein by reference. This section will simply 
identify substitutions that should be made when interpreting the text 
of [RFC6282]. 


In general, the following substitutions should be made: 
- Replace instances of "6LOWPAN" with "MS/TP network" 
- Replace instances of "IEEE 802.15.4 address" with "MS/TP address" 


When a 16-bit address is called for (i.e., an IEEE 802.15.4 "short 
address"), it MUST be formed by padding the MS/TP address to the left 
with a zero octet: 


0 1 

Od DSM 5.6 7 89 Od 2.3.4.5 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
| 0x00 | MS/TP address | 
+-+-+-+-+-+-+-+-+---------------+ 


If LOWPAN_IPHC compression [RFC6282] is used with context, the 
router (s) directly attached to the MS/TP segment MUST disseminate the 
6LoWPAN Context Option (6CO) according to Section 7.2 of [RFC6775]. 


IANA Considerations 


This document uses values previously reserved by [RFC4944] and 
[RFC6282]; it does not require any IANA actions. 
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12. Security Considerations 


See [RFC8065] for a general discussion of privacy threats faced by 
constrained nodes. 


[RFC8065] makes a distinction between "stable" and "temporary" 
addresses. The former are long-lived and typically advertised by 
servers. The latter are typically used by clients and SHOULD be 
changed frequently to mitigate correlation of activities over time. 
Nodes that engage in both activities SHOULD support simultaneous use 
of multiple addresses per device. 


Globally scoped addresses that contain MAC-address-derived IIDs may 
expose a network to address-scanning attacks. For this reason, it is 
RECOMMENDED that a 64-bit semantically opaque IID be generated for 
each globally scoped address in use according to, for example, 
[RFC3315], [RFC3972], [RFC4941], [RFC5535], or [RFC7217]. 
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Appendix A. Abstract MAC Interface 
This Appendix is informative and not part of the standard. 
[BACnet], Clause 9 provides support for MAC-layer clients through its 
SendFrame and ReceivedDataNoReply procedures. However, it does not 
define a network-protocol independent abstract interface for the MAC. 
This is provided below as an aid to implementation. 

A.1.  MA-DATA.request 

A.1.1. Function 
This primitive defines the transfer of data from a MAC client entity 


to a single peer entity or multiple peer entities in the case of a 
broadcast address. 


A.1.2. Semantics of the Service Primitive 
The semantics of the primitive are as follows: 


MA-DATA.request ( 
destination address, 
Source address, 
data, 
type 
) 


The 'destination address' parameter may specify either an individual 
or a broadcast MAC entity address. It must contain sufficient 
information to create the Destination Address field (see Section 1.3) 
that is prepended to the frame by the local MAC sublayer entity. The 
'source address' parameter, if present, must specify an individual 
MAC address. If the source address parameter is omitted, the local 
MAC sublayer entity will insert a value associated with that entity. 


The 'data' parameter specifies the MAC service data unit (MSDU) to be 
transferred by the MAC sublayer entity. There is sufficient 
information associated with the MSDU for the MAC sublayer entity to 
determine the length of the data unit. 


The 'type' parameter specifies the value of the MS/TP Frame Type 


field that is prepended to the frame by the local MAC sublayer 
entity. 
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A.1.3. When Generated 


This primitive is generated by the MAC client entity whenever data 
shall be transferred to a peer entity or entities. This can be in 
response to a request from higher protocol layers or from data 
generated internally to the MAC client, such as a Token frame. 


A.1.4. Effect on Receipt 


Receipt of this primitive will cause the MAC entity to insert all 
MAC-specific fields, including Destination Address, Source Address, 
Frame Type, and any fields that are unique to the particular media 
access method, and pass the properly formed frame to the lower 
protocol layers for transfer to the peer MAC sublayer entity or 
entities. 


A.2. MA-DATA.indication 
A.2.1. Function 


This primitive defines the transfer of data from the MAC sublayer 
entity to the MAC client entity or entities in the case of a 
broadcast address. 


A.2.2. Semantics of the Service Primitive 
The semantics of the primitive are as follows: 


MA-DATA.indication ( 
destination address, 
Source address, 
data, 
type 
) 


The 'destination address' parameter may be either an individual or a 
broadcast address as specified by the Destination Address field of 


the incoming frame. The 'source address' parameter is an individual 
address as specified by the Source Address field of the incoming 
frame. 


The 'data' parameter specifies the MAC service data unit (MSDU) as 
received by the local MAC entity. There is sufficient information 
associated with the MSDU for the MAC sublayer client to determine the 
length of the data unit. 


The 'type' parameter is the value of the MS/TP Frame Type field of 
the incoming frame. 


Lynn, et al. Standards Track [Page 16] 


RFC 8163 IPv6 over MS/TP (6LoBAC) May 2017 


A. 


2.3. When Generated 


The MA DATA.indication is passed from the MAC sublayer entity to the 
MAC client entity or entities to indicate the arrival of a frame to 
the local MAC sublayer entity that is destined for the MAC client. 
Such frames are reported only if they are validly formed and received 
without error, and their Destination Address designates the local MAC 
entity. Frames destined for the MAC Control sublayer are not passed 
to the MAC client. 


.2.4. Effect on Receipt 


The effect of receipt of this primitive by the MAC client is 
unspecified. 


Appendix B. Consistent Overhead Byte Stuffing (COBS) 


This Appendix is informative and not part of the standard. 


[BACnet], Clause 9 corrects a long-standing issue with the MS/TP 
Specification, namely that preamble sequences were not escaped 
whenever they appeared in the Data or Data CRC fields. In rare 
cases, this resulted in dropped frames due to loss-of-frame 
synchronization. The solution is to encode the Data and 32-bit Data 
CRC fields before transmission using Consistent Overhead Byte 
Stuffing [COBS] and decode these fields upon reception. 


COBS is a run-length encoding method that nominally removes ’0x00’ 
octets from its input. Any selected octet value may be removed by 
XOR'ing that value with each octet of the COBS output. [BACnet], 
Clause 9 specifies the preamble octet '0x55' for removal. 


The minimum overhead of COBS is one octet per encoded field. The 
worst-case overhead in long fields is bounded to one octet per 254 as 
described in [COBS]. 


Frame encoding proceeds logically in two passes. The Encoded Data 
field is prepared by passing the MSDU through the COBS encoder and 
XOR'ing the preamble octet '0x55' with each octet of the output. The 
Encoded CRC-32K field is then prepared by calculating a CRC-32K over 
the Encoded Data field and formatting it for transmission as 
described in Appendix C. The combined length of these fields, minus 
two octets for compatibility with legacy MS/TP devices, is placed in 
the MS/TP header Length field before transmission. 


Example COBS encoder and decoder functions are shown below for 
illustration. Complete examples of use and test vectors are provided 
in [BACnet], Annex T. 
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«CODE BEGINS» 


#include «stddef.h» 
#include «stdint.h» 


/* 
* Encodes 'length' octets of data located at 'from' and 

* writes one or more COBS code blocks at 'to', removing any 
'mask' octets that may be present in the encoded data. 

* Returns the length of the encoded data. 

xy 

size_t 

cobs_encode (uint8_t *to, const uint8_t *from, size_t length, 

uint8_t mask) 


{ 


size_t code_index = 0; 
size_t read_index = 0; 
size_t write_index = 1; 


uint8_t code = 1; 
uint8_t data, last_code; 


while (read_index < length) { 

data = from[read_index++]; 

/* 

* In the case of encountering a non-zero octet in the data, 
* simply copy input to output and increment the code octet. 
x7 

if (data != 0) { 
to[write_index++] = data ^ mask; 
code++; 
if (code != 255) 

continue; 

} 

/* 
* In the case of encountering a zero in the data or having 
* copied the maximum number (254) of non-zero octets, store 
* the code octet and reset the encoder state variables. 


xy 
last_code = code; 
to[code index] = code ^ mask; 
code index = write index--*t; 
code = 1; 


} 

/* 
* If the last chunk contains exactly 254 non-zero octets, then 
* this exception is handled above (and the returned length must 
* be adjusted). Otherwise, encode the last chunk normally, as if 
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* a "phantom zero" is appended to the data. 


sy 

if ((last code == 255) && (code == 1)) 
write index--; 

else 
to[code index] - code ^ mask; 


return write index; 


#include «stddef.h» 
#include «stdint.h» 


/* 
* Decodes 'length' octets of data located at 'from' and 
* writes the original client data at 'to', restoring any 
* 'mask' octets that may present in the encoded data. 
* Returns the length of the encoded data or zero if error. 
Ed 
size t 
cobs_decode (uint8_t *to, const uint8 t *from, size_t length, 
uint8_t mask) 
{ 
size_t read_index = 0; 
size_t write_index = 0; 
uint8_t code, last_code; 


while (read_index < length) { 


code = from[read index] ^ mask; 
last_code = code; 
/* 


* Sanity check the encoding to prevent the while() loop below 
* from overrunning the output buffer. 
xp 
if (read index + code > length) 
return 0; 


read_indextt+; 

while (--code > 0) 
to[write indextt] = from[read_index++] ^ mask; 

/* 
* Restore the implicit zero at the end of each decoded block 
* except when it contains exactly 254 non-zero octets or the 
* end of data has been reached. 
sy 

if ((last code != 255) && (read index < length)) 
to[write_index++] = 0; 
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} 


return write_index; 


} 
<CODE ENDS> 
Appendix C. Encoded CRC-32K (CRC32K) 
This Appendix is informative and not part of the standard. 


Extending the payload of MS/TP to 1500 octets requires upgrading the 
Data CRC from 16 bits to 32 bits. P. Koopman has authored several 
papers on evaluating CRC polynomials for network applications. In 
[CRC32K], he surveyed the entire 32-bit polynomial space and noted 
some that exceed the [IEEE.802.3] polynomial in performance. 
[BACnet], Clause 9 specifies one of these, the CRC-32K (Koopman) 
polynomial. 


The specified use of the calc crc32K() function is as follows. 

Before a frame is transmitted, 'crc value' is initialized to all 
ones. After passing each octet of the [COBS] Encoded Data field 
through the function, the ones complement of the resulting 

'crc value' is arranged in LSB-first order and is itself [COBS] 
encoded. The length of the resulting Encoded CRC-32K field is always 
five octets. 


Upon reception of a frame, 'crc value' is initialized to all ones. 
The octets of the Encoded Data field are accumulated by the 

calc crc32K() function before decoding. The Encoded CRC-32K field is 
then decoded and the resulting four octets are accumulated by the 
calc crc32K() function. If the result is the expected residue value 
'CRC32K RESIDUE', then the frame was received correctly. 


An example CRC-32K function is shown below for illustration. 


Complete examples of use and test vectors are provided in [BACnet], 
Annex G.3. 
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«CODE BEGINS» 

#include «stdint.h» 

/* See ANSI/ASHRAE Standard 135-2016 [BACnet], Section G.3.2 */ 
#define CRC32K INITIAL VALUE (OxFFFFFFFF) 

#define CRC32K RESIDUE (0x0843323B) 


/* CRC-32K polynomial, 1 + x**1 + ... + x**30 (+ x**32) */ 
#define CRC32K POLY (0xEB31D82E) 


/* 
* Accumulate 'data value' into the CRC in 'crc value”. 
* Return updated CRC. 

* 
* Note: crc value must be set to CRC32K INITIAL VALUE 
* before initial call. 
*/ 
uint32 t 


calc crc32K (uint8 t data value, uint32 t crc value) 


( 
int b; 


for (b = 0; b < 8; btt) { 
if ((data value & 1) ^ (crc value & 1)) { 
crc value >>= 1; 
crc, value ^- CRC32K POLY; 
) else { 
crc value >>= 1; 
} 
data_value >>= 1; 
} 
return crc_value; 


} 


<CODE ENDS> 
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Appendix D. Example 6LoBAC Frame Decode 
This Appendix is informative and not part of the standard. 


BACnet MS/TP, Src (2), Dst (1), IPv6 Encapsulation 
Preamble 55: 0x55 
Preamble FF: Oxff 
Frame Type: IPv6 Encapsulation (34) 
Destination Address: 1 
Source Address: 2 
Length: 537 
Header CRC: Oxlc [correct] 
Extended Data CRC: 0x9e7259e2 [correct] 
6LoWPAN 
IPHC Header 
Oll. .... = Pattern: IP header compression (0x03) 
.1 1... .... .... = Traffic class and flow label: 
Version, traffic class, and flow label 
compressed (0x0003) 
.0.. .... .... = Next header: Inline 
.00 .... .... = Hop limit: Inline (0x0000) 
1... .... = Context identifier extension: True 
.1.. .... = Source address compression: Stateful 
.01 .... = Source address mode: 
64-bits inline (0x0001) 
0... = Multicast address compression: False 
.1.. = Destination address compression: 
Stateful 
.10 = Destination address mode: 
16-bits inline (0x0002) 
Source context identifier: 0x00 
0000 = Destination context identifier: 0x00 
[Source context: aaaa:: (aaaa::)] 
[Destination context: aaaa:: (aaaa::)] 
Next header: ICMPv6 (0x3a) 
Hop limit: 63 
Source: aaaa::1 (aaaa::1) 
Destination: aaaa::ff:fe00:1 (aaaa::ff:fe00:1) 


0000 
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IPv6 over MS/TP (6LoBAC) 
Internet Protocol Version 6, Src: aaaa::1 

Dst: aaaa::ff:fe00:1 

0110 serous = 

0000 0000 = 

0000 00.. - 

.0. = 

0 = 


Payload length: 518 


Next header: ICMPv6 (58) 
Hop limit: 63 
Source: aaaa::1 (aaaa::1) 
Destination: aaaa::ff:fe00:1 
Internet Control Message Protocol v6 
Type: Echo (ping) request (128) 
Code: 0 
Checksum: 0x783f [correct] 
Identifier: 0x2ee5 
Sequence: 2 
[Response In: 5165] 
Data (510 bytes) 
Data: 
[Length: 510] 
et al. Standards Track 


Lynn, 


0000 0000 0000 0000 0000 


May 2017 


(aaaa::1), 


= Flowlabel: 


(aaaa::ff:fe00:1) 
Version: 6 

Traffic class: 
0x00000000 
Differentiated 
Services Field: 
Default (0x00000000) 
ECN-Capable Transport 
(ECT): Not set 
ECN-CE: Not set 
0x00000000 


(aaaa::ff:fe00:1) 


e4dbe8553ba0040008090a0b0c0d0e0F1011121314151617... 
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Frame (547 bytes): 


55 ff 22 01 02 02 19 1c 56 2d 83 56 6f 6a 54 54 Us enel os V-.VojTT 
54 54 54 54 57 54 56 54 d5 50 2d 6a 7b bO 5c 57 TTTTWTVT.P-j(.NW 
bl Be bd 00 6e f5 51 ac 5d 5c 5f 5e 59 58 5b 5a TE ek Wis di 


45 44 47 46 41 40 43 42 4d 4c 4f 4e 49 48 4b 4a EDGFA@CBMLONIHKJ 
75 74 77 76 71 70 73 72 7d 7c 7£ Te 79 78 Th 1a utwvgpsr}|.~yx{z 
65 64 67 66 61 60 63 62 6d 6c 6f 6e 69 68 6b 6a edgfa `cbmlonihkj 
15 dd. TT X6 I1 -b0 ABA2 Id, Le TE ey 19.18 Ib Ta. l2: VERG 
05 04 07 06 01 0003 02 Od Oc Of Oe 09 08 Ob Oa  .............. e 
35 34 37 36 31 30 33 32 3d 3c 3f 3e 39 38 3b 3a 54761032=<?>98;: 
25 24 27 26 21 20 23 22 2d 2c 2f 2e 29 28 2b 2a SS'&! d"—-,/.) (** 
d5 d4 d7 dé di dO d3 d2 dd dc df de d9 d8 db da  ................ 
EI c4 Gy i1c6.dl-oc0.c3. 02 Ed ee:ef Ce c9 08 GD QR MNS RR BOS Gus 
R5 A fT £6 Kl KOEI £2. fd fc. ff fe-f9 f8 fb RA EER Vy. 
e5 e4 e7 e6 el e0 e3 e2 ed ec ef ee e9 eB eb ea  J................ 
95 94 97 96 91 90 93 92 9d 9c 9f 9e 99 98 9b 9a J .......... en 
85 84 87 86 81 80 83 82 8d 8c 8f Be 89 88 8b Ba  .............. si 
b5 b4 b7 b6 bl DBO b3 b2 bd bc bf be b9 b8 bb ba  ................ 
a5 a4 a7 a6 al a0 a3 a2 ad ac af ae a9 a8 ab aa  ................ 
ab 54 57 56 51 50 53 52 5d 5c 5f 5e 59 58 5b 5a . TWVQPSR] \_*YX[Z 
45 44 47 46 41 40 43 42 4d 4c 4f 4e 49 48 4b 4a EDGFA@CBMLONIHKJ 
75 74 77 76 71 70 73 72 7d 7c 7f 7e 79 78 7b 1a utwvgpsr}|.~yx{z 
65 64 67 66 61 60 63 62 6d 6c 6f 6e 69 68 6b 6a edgfa `cbmlonihkj 
TILA L7 VO AI X0 3-12 Td shes Lf te TY Iê Tp Las Ael AE oe owes OS 
05 04 07 06 01 00 03 02 Od Oc Of Oe 09 08 Ob Oa  ............. 
35 34 37 36 31 30 33 32 3d 3c 3f 3e 39 38 3b 3a 54761032=<?>98;: 
25 24 27 26 21 20 23 22 2d 2c 2f 2e 29 28 2b 2a SS'&! #"-,/.) (+* 
d5 d4 d7 dé dil dO d3 d2 dd dc df de d9 d8 db da  ................ 
C5: c4 c7 Gé El EO O3 C2: Cd. CC CE BED 9 CD Cal» iua] EY 
fb f4 £7 f6 fl £0 £3) £2: fa fc f£ fe £9: f8 fb fad abt EER RES densa 
e5 e4 e7 e6 el e0 e3 e2 ed ec ef ee e9 e8 eb ea  ................ 
95 94 97 96 91 90 93 92 9d 9c 9f 9e 99 98 9b 9a . ........... nn 
85 84 87 86 81 80 83 82 8d 8c 8f Be 89 88 8b Ba .............. eee 
b5 b4 b7 b6 bl BO b3 b2 bd bc bf be b9 b8 bb ba  .............. 
a5 a4 a7 a6 al a0 a3 a2 ad ac af ae a9 a8 50cb  .............. P. 
27 Oc b7 mos 
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Decoded Data and CRC32K (537 bytes): 
78 de 00 3a 3£ 00 00 00 00 00 00 00 01 00 01 80 Moa P. EE eus 


00 78 3f Ze e5 00 02 e4 db e8 55 3b a0 04 00 08 XT Ee RES UF ees 
09. Qa 0b: Oe 0d 0e Of 10 11 12-13 14.19. LE I7, 18. i212... 9995 
19. la Ib te. id Te Lt 20°21 22 23.24 25 26 21.28 . vw IM#SSE! ( 


29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 )*+,-./012345678 
39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 9:;<=>?@ABCDEFGH 
49 4a 4b 4c 4d 4e 4£ 50 51 52 53 54 55 56 57 58 IJKLMNOPQRSTUVWX 
59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 YZ[N]^. `abcdefgh 
69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 18 ijklmnopqrstuvwx 
79 7a 7b 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 yz{|}~ Vr e EM da eue 
89 8a 8b 8c 8d Be 8f 90 91 92 93 94 95 96 97 98 ............. eee 
99 9a 9b 9c 9d Ye 9f a0 al a2 a3 ad a5 ab a7 a8  ................ 
a9 aa ab ac ad ae af b0 bl b2 b3 b4 b5 b6 b7 b8  ................ 
bo: ba bb. be.bd be. bf Or cl. ies c3 c4 c5 26.07 C8. SERE RE v4 
G9: ca.cboce ed. ce cf. d0-dl d2 d3 d4 'd5dé. d7-d8- EE wee aes 
d9 da db dc dd de df e0 el e2 e3 e4 e5 e6 e7 e8 .)................ 
69 ea eb ec ed ee ef £0 fl £2. f3 f4 f5 £6 £7 f8 [e 
£9 fa fb fc fd fe ff 00: 02 02 03 04 05°06 OF 08 2X4 e eR 
09 0a. 0b. Oc 0d Oe Of 10 11 12 13 14 15-16. 17 18 EV 
19 1a. 1b ie dd te If 20 215/22 23.2425 26 27-28- BEES I"£$$&'( 
29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 )**,-./012345678 
39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 9:;<=>?@ABCDEFGH 
49 4a 4b 4c 4d 4e 4£ 50 51 52 53 54 55 56 57 58 IJKLMNOPQRSTUVWX 
59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 YZ[N]^. `abcdefgh 
69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 18 ijklmnopqrstuvwx 
79 7a 7b 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 ad EERS od 
89 8a 8b 8c 8d 8e 8£ 90 91 92 93 94 95 96 97 VB  ......... Ese 
99 9a 9b 9c 9d 9e 9f a0 al a2 a3 ad a5 ab a7 a8  ................ 
a9 aa ab ac ad ae af b0 bl b2 b3 b4 b5 b6 b7 b8B......... ss ss se 
b9 ba bb be bd be bf c0 cl c2 c3 ed c5 EO OT 08. llle wees 
c9 ca cb cc cd ce cf dO dl d2.d3 d4 d5.d6.:dY7-^d8- V ETUR 
d9 da db dc dd de df e0 el e2 e3 e4 e5 e6 e7 e8  )................ 
e9 ea. eb ec ed-ee et fÜ fl f2 f3 f4 f5 £6 £7 TB . MI. i. a 
£9 ta fb ffc fd 9e 12 D9 eZ  - .- -  - ^" *- ." $e EY: 
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Decompressed 6LoWPAN IPHC (558 bytes): 

60 00 00 00 02 06 3a 3f aa aa 00 00 00 00 00 00 Maa ens D ord syst e us 
00 00 00 00 00 00 00 01 aa aa 000000000000  J................ 
00 00 00 ff fe 00 00 01 80 00 78 3f 2e e5 0002 .......... ER 
e4 db e8 55 3b a0 04 00 08 09 Oa Ob Oc Od Oe OF DENDUM 
10 11. I2 133-14-L5 16 475 ANB. Oi ear Ips te Ld 16 Tf adie ES ES xsv 
20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f IM#SS&" () *+,-./ 
30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 0123456789:; <=>? 
40 41 42 43 44 45 46 47 A8 49 4a 4b 4c 4d 4e 4f @ABCDEFGHIJKLMNO 
50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f PQRSTUVWXYZ[N]^.. 
60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d be 6f `abcdefghijklmno 
70 71 72 73 74 75 16 77 18 79 7a 7b 7c Jd 7e 7£ parstuvwxyz(|])^. 
80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d Be 8f | ................ 
90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d Ye 9f  .......... ee ee 
a0 al a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af ................ 
DO b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf  J................ 
cGOdloe2 c3- 64^ c5. C6 CP G8 c9 Ca, CD EG Ed ee Cf. aV wREY VERA 
dO di d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df  ................ 
e0 el e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef | ................ 
FO EL X2 f3 f4 f5 fo f7-f8 £9 fa fb fc- fd fèe ff. 1.2 
00 01 92 93 04..05- 06 07 08° 09. Oa Ob: Oe Od. 0e Of. ues 
10:14. 12-13. 14 15 46 dy 8.19 Ta tb le Ad AE Lf ic Sethe yard 
2021 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f I"4$$$&'()*t,—-./ 
30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 0123456789:; <=>? 
40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f @ABCDEFGHIJKLMNO 
50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f PQRSTUVWXYZ[N]^.. 
60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d be 6f `abcdefghijklmno 
70 71 72 73 74 75 16 77 18 79 7a "7b 7c Jd 7e 7f parstuvwxyz(|])^. 
80 81 82 83 84 85 86 87 88 89 Ba 8b 8c 8d Be 8f | ................ 
90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f | .......... ese 
a0 al a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af ................ 
DO b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf  J................ 
CO -elL:c2-c3 BA FEB c6 cT (G68-c9.ca-cb co cd.ce cf EER lev as 
dO dl d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df  ................ 
e0 el e2 e3 ed e5 e6 e7 e8 e9 ea eb ec ed ee ef . ................ 
fO fl £2.43 PACES £6. TT ES £9 FESR fC fd RERIG 
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